On 3/3/26 3:15 PM, Bart Van Assche wrote:
The comment above __drm_fb_helper_initial_config_and_unlock() says
"Drops fb_helper->lock before returning". However, there is an
error path in that function that does not drop fb_helper->lock:
info = drm_fb_helper_alloc_info(fb_helper);
if (IS_ERR(info))
return PTR_ERR(info);
Is the code correct or is the comment correct? I don't think that
both can be correct.
(+Thomas)
Thomas,
Does this untested patch make sense to you?
Thanks,
Bart.
drm: Fix a locking bug in an error path
Make sure that __drm_fb_helper_initial_config_and_unlock() unlocks
fb_helper->lock. This has been detected by the Clang thread-safety
analyzer.
Fixes: 63c971af4036 ("drm/fb-helper: Allocate and release fb_info in
single place")
Signed-off-by: Bart Van Assche
diff --git a/drivers/gpu/drm/drm_fb_helper.c
b/drivers/gpu/drm/drm_fb_helper.c
index 05803169bed5..16bfbfb0af16 100644
--- a/drivers/gpu/drm/drm_fb_helper.c
+++ b/drivers/gpu/drm/drm_fb_helper.c
@@ -1641,8 +1641,10 @@ __drm_fb_helper_initial_config_and_unlock(struct
drm_fb_helper *fb_helper)
drm_client_modeset_probe(&fb_helper->client, width, height);
info = drm_fb_helper_alloc_info(fb_helper);
- if (IS_ERR(info))
+ if (IS_ERR(info)) {
+ mutex_unlock(&fb_helper->lock);
return PTR_ERR(info);
+ }
ret = drm_fb_helper_single_fb_probe(fb_helper);
if (ret < 0) {
